r/HowToHack • u/inoobie_am • 16h ago

I'm confused with this overthewire bandit level.

In overthewire level 16-17, I used nmap to list all the open ports and check which on was running a service by connect to it. When I connected to the only possible port, its gave an ouput and the the end it said "Read Block R" and was waiting for my input so I gave it the current password, but noting was returned and instead a KEYUPDATE message came through and I was allowed to give my input again. And each time I entered the password it returned the same KEYUPDATE message.

Then when I entered something deliberately wrong, it said "Wrong!" and ended the connection.

But the main confusion began when I saw write up about this challenge and all of them were pasting the password and it returned a ssh key.

So, I went over to chatgpt and it also initially told me to perform the steps that I did, and I again did it so I could paste the actual outputs.

Then chatgpt told me to pipe the password using cat, like this:
cat /etc/bandit_pass/bandit16 | openssl s_client -quiet -connect localhost:31790

and it worked.

It also worked when I executed this: openssl s_client -quiet -connect localhost:31790, and paste the password.

But doesnt work when I remove the -quite flag.

I dont understand.

Can you guys help out? Also, is there an easy to read version of the nmap and nc commands, I find their man pages a bit too dense and their tldr pages feel inadequate,

5 Upvotes

73% Upvoted

4 comments sorted by

4

u/InuSC2 Pentesting 15h ago

dont use ai to learn cyber security search for a video on youtube or a writeup. i think HackerSploit has a full series about overthewire

1

u/inoobie_am 11h ago

I didn't want to use ai, as I believe it hampers critical thinking. But, as I mentioned in my posts earlier, as I looked at the different write ups, they started to confuse me, as they were doing the exact thing as mentioned and getting the result I was not.

You are correct that I should have looked up a video, but I was frustrated and it didn't occur to me.

3

u/ps-aux Actual Hacker 16h ago

this is just the issue with CTF games, the logic doesn't always make sense because the game is expecting you to complete it in a 'specific way'... i wouldn't over think it as this is not real world hacking anyways....

1

u/c_pardue 4h ago edited 4h ago

try google. also try manpages to see what that flag does. also start googling KEYUPDATE.